The accessibility, ubiquity and convenience of the Internet is rapidly changing the way people access information. The World Wide Web (“WWW”), usually referred to as “the web”, is the most popular means for retrieving information on the Internet. The web enables user access to a practically infinite number of resources. These comprise the likes of interlinked hypertext documents accessed by a hypertext transfer protocol (HTTP), and extensible markup language (XML) protocols from servers located around the world. Organizations expose their business information and functionality on the web through software applications, usually referred to as “web applications” or “enterprise applications”. The web applications use the Internet technologies and infrastructures. A typical web application is structured as a three-layer system, comprising of a presentation layer, a business logic layer, and a data access layer. The multiple layers of the enterprise application are interconnected by application protocols, such as HTTP and structured query language (SQL).
Web applications provide great opportunities for enterprises or organizations. However, at the same time these applications are vulnerable to attack from malicious, irresponsible or criminally minded individuals, also known as web hackers, or organizations. For this reason, enterprises use security systems to protect their web applications from a plurality of types of attacks.
One solution utilized to secure web applications of a web server is the use of firewalls. They provide a sufficient protection against low-level protocols used for attacks, such as transmission control protocol (TCP) or user datagram protocol (UDP). However, the firewalls cannot protect against application level protocols, such as HTTP or any other proprietary protocols. Security solutions designed to protect web applications from attacks committed through application level protocols are known as application level security systems.
Application level security systems are designed to detect illegal requests sent to an application. Amongst other violations, these systems try to identify requests submitted by clients that tamper what should otherwise be read-only parameters. Read-only parameters are comprised in a web page and comprise fixed fields, hidden fields, menu options, and so on. For example, a client is not entitled to change the price of a product offered for sale on a web site, and therefore the price field should be designated as a read-only parameter.
One security solution for detecting unauthorized commands is discussed in U.S. Pat. No. 6,311,278 (hereinafter the '278 patent) by Raanan, et al. The '278 patent discloses a method and system for automatically and continually extracting application protocol data for defining a set of allowable (or authorized) actions. The method involves intercepting each protocol message in its entirety before it is sent or in parallel with sending to a client (by a server). The message is in response to a specific request from the client. The method then translates the message into internal format parses the message to identify user-selectable options contained in the message, and translates the massage back to be sent on the network. The user-selectable options may be commands (e.g., a submit command in an HTML form), fields, and so on. These items represent the set of allowable or authorized user actions for a particular session. The set of allowable user actions is stored in a protocol database accessible to a gateway or filter module. Once the gateway or filter module receives a client request, it compares data, commands or other actions in the request with the corresponding entities now stored in the protocol database. If no such disallowed actions are in the request, the request is transmitted to the server; otherwise, the entire request is denied.
The security solution described in the '278 patent is inefficient for blocking web attacks by enforcing read-only parameters. One of many reasons is the high number of false positives of detection error produced by the system. As mentioned above, the system detects web attacks by profiling allowed and disallowed actions. However, some actions (or commands) are not considered as read-only parameters, and thus a client can modify them. In such case, the system would generate an alarm even if the client's action is legal. Another reason for the system's inefficiency is the poor performance which results from processing each any every response, even though the response does not comprise a read-only parameter, and the latency induced by translating each response and request to and from the internal representation. Furthermore, the security solution of the '278 changes the formant of intercepted messages, and thus, such a solution cannot manifest itself as a non-intrusive security solution.